Tandem is a governance runtime for AI agents.
AI agents need authority, not just tools.
Tandem is for teams letting agents touch real tools, code, customer data, and production systems.
Tools
Which built-in and MCP tools are in scope.
Data
Which data the agent can see.
Approval
Which risk tier requires human-in-the-loop approval.
Record
Which audit evidence survives the run.
Self-hostable. Open-core: protocol, SDKs, and clients are MIT / Apache-2.0; the engine server and governance components are source-available under BUSL-1.1 — free for evaluation and personal non-commercial use, with commercial production use licensed by Frumu LTD.
Tandem runtime · policy check
Every action checked before it runs.
run #4812 · agent support-triage · grant support.tier-1
→ crm.lookup_account
scope: ticket-4812
→ tickets.read
data: account, ticket, policy docs
→ refunds.create
amount: $1,240 · gate: refunds > $500
→ db.users.delete
reason: tool not in grant
The risk starts when the agent can act.
An agent reads a support ticket, opens CRM, calls an internal API, and has a database tool in reach. A bad instruction can make it leak customer data, send the wrong message, or change production state.
An agent is dangerous because of what it can do and see, not because of what it says.
A content filter would not stop a valid-looking tool call. Tandem stops the action earlier: an agent cannot delete a database it was never given access to.
Support ticket
The agent starts with a real customer problem.
CRM access
It can read account and history data.
Internal API
It can trigger actions outside chat.
Database tool
It can reach systems where a mistake becomes an incident.
Tandem separates intelligence from authority.
The agent is not the authority. The runtime is.
Model
Reasons, plans, drafts, and proposes the next action.
Tandem runtime
Checks scope, data access, tool policy, approval rules, and run state.
Business systems
Tools, code, customer data, APIs, messages, and production systems.
Audit record
Who requested the action, what was allowed, who approved it, what ran, and what happened.
The model can propose a tool call.
The runtime decides what data and systems are in scope.
The action runs only after the authority check passes.
What Tandem decides before the agent acts.
Scoped MCP tools
Apply step-level policy to built-in and MCP tools, so each agent receives only the authority needed for the task.
Data in context
Show the account, ticket, and policy docs needed for the task. Do not expose every tenant, every document, or the whole transcript history.
Risk-tiered actions
Let low-risk lookups run automatically, while consequential actions pause at a human-in-the-loop approval gate.
Audit evidence
Record the request, scope, policy decision, approver, tool call, result, denial, and artifact.
The run survives the model call.
A protected action can pause for review, preserve its approval context, and resume without rebuilding the run from chat history.
Durable approval state
The requested action, policy decision, and approval state persist outside the model context window.
Resume with context
Approved work can resume after a restart with the same scope and decision context.
Reconstruct the run
Operators can follow the durable evidence behind each transition, denial, tool call, and outcome.
For lower-level integrations, signed context assertions can carry the principal, grant, resource, policy decision, and audit event to downstream systems.
Keep the brain and kill switch separate.
Do not put your business brain and your business kill switch in the same vendor.
Use Claude, OpenAI, Gemini, local models, coding agents, MCP tools, or internal copilots. The model can change. The authority boundary stays with Tandem, under your control.
Workers
Reasoners, agents, connectors, and tools
The model proposes work. Tandem decides what can run, what data is visible, when approval is required, and what record survives.
Open-core authority, with an enterprise path
Source-available runtime
The core runtime, SDKs, clients, and local development surfaces are inspectable, with selected governance components source-available under the documented open-core license boundary.
Current runtime controls
Durable runs, scoped tools, approval gates, artifact validation, protected audit events, and tenant-aware records are the foundation available today.
Enterprise path
Full RBAC, OIDC/SSO, SCIM, SIEM export, SOC2 materials, private sidecar enforcement, and immutable receipt chains are roadmap items, not shipped guarantees.
Open-core. The protocol, SDKs, clients, and local tooling are permissively licensed (MIT / Apache-2.0). The engine server and governance components (the plan compiler, governance engine, incident monitor, and enterprise server) are source-available under BUSL-1.1 — free for evaluation, development, testing, personal non-commercial use, and non-production proofs of concept. Commercial production use, including internal production use and client deployments, requires a commercial license from Frumu LTD.
Running agents in production?
If agents can touch real systems, put their authority boundary somewhere explicit.
A Frumu AI project